Question

I need to do a homework about analysis some packets.
I found that BPF filtering is a good thing for my homework, I want to filter all packet that have a payload that start with a specific string like "Test it". The packets are combination of TCP,UDP,ICMP and some may not even have a payload.
How can I set the filter?

Answer 1

I found the answer,
http://www.foo.be/cours/dess-20112012/bpf/bpf.pdf

in this pdf, there is a place talking about BPF syntax to filter payload. The following is from the pdf, in this way, we can use the BPF to skip the header
An example, you want to match "GE" string in a TCP payload :
echo -n "GE" | hexdump -C
00000000 47 45 |GE|
sudo tcpdump -s0 -n -i ath0 "tcp[20:2] = 0x4745"

Answer 2

如何过滤<代码>的典型例子 HTTP GET 带有倾角和BPF过滤器的申请

tcp[((tcp[12:1] & 0xf0) >> 2):4]

There is a good explanation about above filter in details https://security.stackexchange.com/questions/121011/wireshark-tcp-filter-tcptcp121-0xf0-24 https://wiki.wireshark.org/CaptureFilters

友情链接